SearchSubscribe

Vulnerability research & advisories

We find the flaws before attackers do.

Original research and coordinated disclosure across cloud, AI, OT and enterprise software. Every advisory, every CVE, in one place.

Browse advisoriesRead the disclosure policy
Advisories published
1,180
CVEs assigned
2,400+
Vendors coordinated
410
Latest advisorycriticalUnauthenticated remote code execution via agent update channelTRA-2026-44CVSS 9.8

Advisories

Tenable Research Advisories

RSSAll 12 advisories

Every vulnerability we disclose gets a TRA: what is affected, how severe it is, and where the fix stands. Filter by severity or search a CVE, vendor or product.

  1. TRA-2026-44Unauthenticated remote code execution via agent update channelHelix Systems · Helix Fleet ManagerCVE-2026-411879.8criticalNo patch
  2. TRA-2026-43Prompt injection leads to tool-call exfiltration in AI coding assistantLumen Labs · Lumen Copilot for IDEsCVE-2026-40912CVE-2026-409138.6highPatched
  3. TRA-2026-42Hardcoded maintenance credentials in PLC web interfaceQuanta Automation · Q-Series PLC firmware 4.xCVE-2026-397719.1criticalMitigation available
  4. TRA-2026-41Cross-tenant data access through misconfigured federated identityNorthwind Cloud · Northwind Identity FederationCVE-2026-388208.1highPatched
  5. TRA-2026-40Stored XSS in ticket comments enables session takeoverBrightdesk · Brightdesk Service CloudCVE-2026-381046.4mediumPatched
  6. TRA-2026-39Pre-auth stack overflow in SSL VPN portalCorvane Networks · Corvane SecureGate 7CVE-2026-374559.8criticalPatched
  7. TRA-2026-38Debug UART exposes root shell on smart building gatewayOstra · Ostra Hub BX-200CVE-2026-366906.8mediumNo patch
  8. TRA-2026-37Model registry path traversal overwrites serving artifactsFathom AI · Fathom MLOps PlatformCVE-2026-355127.7highPatched

Showing 8 of 8 latest advisories

Research

The work behind the advisories

All research

Talks & papers

  1. PaperUSENIX Security '26Poisoned weights: supply chain attacks on ML model registriesSofia Brandt
  2. TalkDEF CON 34Tenant boundaries are a suggestion: breaking federated identity at scaleRémi Laurent

Coverage

Where we look

Our researchers specialise by attack surface, from cloud control planes to the controllers on a factory floor.

  1. 01CloudIdentity federation, serverless runtimes, managed services02 recent
  2. 02AI & LLMAI agents, coding assistants, model supply chain02 recent
  3. 03OT & ICSPLCs, protocol gateways, engineering workstations02 recent
  4. 04Network devicesVPN portals, firewalls, edge appliances01 recent
  5. 05Enterprise softwareEndpoint management, backup, collaboration suites02 recent
  6. 06Web applicationsSaaS platforms, identity flows, client-side code02 recent
  7. 07IoT & embeddedGateways, firmware, debug interfaces01 recent

Coordinated disclosure

90 days.
Then we publish.

Every vendor gets the same window to ship a fix. When it closes, defenders get the details, patched or not.

Read the full policy
Median time to publish
90 days
Fixed or mitigated at publication
83%
  1. 01 · Day 0

    Report

    We send the vendor full technical details and a proof of concept over a secure channel.

  2. 02 · Day 7

    Acknowledge

    We expect an acknowledgement within a week, and help reproduce if needed.

  3. 03 · Day 45

    Check in

    Midway, we confirm a fix date. Credible progress can earn a short extension.

  4. 04 · Day 90

    Publish

    The TRA goes live with details, CVEs and the vendor’s remediation guidance.